f2b1f6794cbc7383de4f89f32686ab3bfd47e1d1b6ab25ae319b54e52823a7cb

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bloom.exe
Size

693KB
MD5

a6bbe050f468203e8f43cf26b3417dd5
SHA1

0754517312b1b097141655b83cc885077171999e
SHA256

f2b1f6794cbc7383de4f89f32686ab3bfd47e1d1b6ab25ae319b54e52823a7cb
SHA512

b59641496ad42b556cb55dea5874c8c2b94c2238370c197d965365a8250cf16c22c77405b2ac7a615d8edf619db6c90cc7bc421d9747711624e4fa6f495fbadd
SSDEEP

12288:4Mvxtw7/GN42UhBWdd0pwcLp2AKxZm627lqcVDtDOypUJrON2YOFHgU:nvXQnB+Wp3pRKxYl7McVD1Ou7OFV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2292-0-0x0000000140000000-0x00000001401B5000-memory.dmp	upx
behavioral2/memory/2292-3-0x0000000140000000-0x00000001401B5000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe
Token: 33	772	WMIC.exe
Token: 34	772	WMIC.exe
Token: 35	772	WMIC.exe
Token: 36	772	WMIC.exe
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe
Token: 33	772	WMIC.exe
Token: 34	772	WMIC.exe
Token: 35	772	WMIC.exe
Token: 36	772	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2292	bloom.exe
2292	bloom.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2292	bloom.exe
2292	bloom.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2292	bloom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 840	2292	bloom.exe	85
PID 2292 wrote to memory of 840	2292	bloom.exe	85
PID 840 wrote to memory of 772	840	cmd.exe	87
PID 840 wrote to memory of 772	840	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\bloom.exe
"C:\Users\Admin\AppData\Local\Temp\bloom.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid > "C:\Users\Admin\AppData\Local\Temp\UUID.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UUID.txt

Filesize
6B

MD5
bea07e6d2b8dce396fe21baa61b34956

SHA1
665332b36fc8fa1ed11210cdee83b639b451e592

SHA256
2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7

SHA512
4ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1

Download Submit
memory/2292-0-0x0000000140000000-0x00000001401B5000-memory.dmp

Filesize
1.7MB

Download
memory/2292-3-0x0000000140000000-0x00000001401B5000-memory.dmp

Filesize
1.7MB

Download